TIBCO Spotfire Server 3.2.2 - TIBCO Product Documentation

Advanced Procedures
9.5 Configuring LDAPS
In an LDAP environment, where the Spotfire system authenticates users with an
LDAP directory, it might be a good idea to secure the LDAP protocol using SSL, if the
LDAP directory supports this.
To achieve this, you must first set up the LDAP directory to communicate using SSL.
Refer to your LDAP server manual for instructions on this.
Then you must get the Spotfire Server(s) to trust this certificate. This is done by
following steps:
1 Export the certificate to file and copy it to the Spotfire Server(s) and the configuration
console machine(s).
2 With a command prompt or shell, navigate to the directory /jdk/jre/lib/security and execute the keytool command located in the
/jdk/bin/ directory to import the certificate:
../../bin/keytool -import -file ldapserver.crt -keystore cacerts -alias spotfire_ldaps
Replace ldapserver.crt with the name of the exported certificate.
When prompted, enter the password to the cacerts keystore. The default password is
“changeit”.
3 Verify that the certificate has been successfully added by using the keytool command
again:
../../bin/keytool -list -keystore cacerts -alias spotfire_ldaps
When prompted, enter the password to the cacerts keystore. The result of the
command should be that the certificate is added.
Once the server certificate is trusted by all the Spotfire Servers, log into the
configuration console and set Authentication Method to LDAPS. Refer to the
configuration console help for assistance.
9.6 Database Authentication using Kerberos
If your database engine is able to authenticate users using Kerberos, you can let the
Spotfire Server authenticate with it in this way.
To set this up, you need to perform a number of manual steps. While it is possible to
perform these steps on a running Spotfire installation, it is recommended that you do
them before defining a Spotfire cluster, and before you log into the configuration
console for the first time.
You also need to make sure to either be logged into the database server with the user
created below when creating the Spotfire database, or ensure that you can give this
user access to the Spotfire database later. Refer to your database engine manual for
more details on this.
TIBCO Spotfire® Server 3.2.2 91 (144)